LiteLLM guardrail sandbox escape and prompts/test template injection disclosed

Undisclosed·LiteLLM (LLM/agent gateway and proxy)

LiteLLM's custom-code guardrail feature — which runs user-supplied validation/moderation code in a sandbox before it reaches the underlying LLM or agent — could be escaped, letting attacker-controlled guardrail code run outside its intended isolation boundary. A second, separate flaw let attackers submit a malicious template to the /prompts/test endpoint, which LiteLLM rendered server-side without adequate sanitisation (server-side template injection).

Blast radius

not disclosed — no specific victim organisation or breach volume is named in the advisory data; the exposure is to any LiteLLM deployment that enables custom-code guardrails or exposes the /prompts/test endpoint, both rated CVSS 3.1 8.8 (network vector, low privileges required, no user interaction, high confidentiality/integrity/availability impact)

Root cause

the guardrail sandbox did not fully isolate user/LLM-supplied code from the host process, and the prompt-test endpoint rendered caller-supplied template input server-side instead of treating it as untrusted data

How it was caught

surfaced through coordinated vulnerability disclosure and published as CVE/GHSA/OSV advisories rather than through a reported customer incident; no evidence in the available records of in-the-wild exploitation before disclosure

Take-awayAny endpoint that executes 'guardrail' code or renders templates on behalf of an LLM/agent request is a code-execution surface — sandbox it with the same rigor as untrusted user code, not as trusted configuration.